PatchSiren cyber security CVE debrief
CVE-2026-45157 nextcloud CVE debrief
A medium-severity information disclosure vulnerability in Nextcloud Server allows a malicious user with access to a file share to leverage the share token to access chunking upload endpoints and view temporary part files during ongoing uploads. The issue affects Nextcloud Server versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2. The vulnerability stems from improper access control (CWE-284) where share tokens granted broader access than intended to the chunking upload mechanism. This was reported through HackerOne and addressed via a server pull request. No known exploitation in ransomware campaigns has been documented.
- Vendor
- nextcloud
- Product
- security-advisories
- CVSS
- MEDIUM 6.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Nextcloud Server administrators, security teams managing content collaboration platforms, and organizations relying on Nextcloud for sensitive file sharing operations
Technical summary
The vulnerability exists in Nextcloud Server's chunking upload implementation where share tokens, normally restricted to file download/access operations, could be reused to authenticate against the chunking upload endpoint. This allowed an attacker with legitimate share access to enumerate temporary part files (.part) during active uploads by other users, exposing file metadata and partial content. The fix implemented in the referenced pull request adds authorization checks to ensure share tokens cannot access upload chunking endpoints. The attack requires network access, low attack complexity, legitimate user privileges (share recipient), and user interaction, with no availability impact but high confidentiality impact and low integrity impact.
Defensive priority
medium
Recommended defensive actions
- Upgrade Nextcloud Server to version 32.0.9 or 33.0.3, or apply the corresponding Enterprise Server patch version applicable to your release track
- Review share token permissions and validate that file share access does not extend to upload chunking endpoints
- Monitor for unauthorized access to temporary part files in upload directories
- Validate that WebDAV chunking endpoints enforce proper authorization boundaries independent of share tokens
Evidence notes
The CVE description confirms affected version ranges and remediation paths. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) supports the 6.3 medium severity rating with high confidentiality impact. The GitHub Security Advisory and HackerOne report provide vendor-confirmed technical details. The pull request reference indicates code-level remediation.
Official resources
2026-06-01